cat1: live probes — protocol/curation PASS, per-user list gateway-wide (finding), ungranted rejected

2026-06-18 11:01:07 -04:00
parent 30d19d42eb
commit 2d02ddbd35
5 changed files with 103 additions and 20 deletions
@@ -44,6 +44,8 @@ Self-hosted on `backstage-wus2-v4` via Flux; vendor Helm chart **1.8.8**
  `Authorization: Bearer <ARCADE_API_KEY>` + `Arcade-User-ID: <user_id>`. The user_id is any stable
  string (an email works); this mode is for clients without browser auth / token refresh. Self-hosted
  gateway URL: `https://api.arcade.st.dev/mcp/<slug>`. (Source: docs.arcade.dev call-tool-client.)
- **Baseline gateway:** _slug + tool allow-list (Task 1.2)_
+- **Baseline gateway:** `zeb-gateway-test` — auth mode **Arcade Headers** (API key + `Arcade-User-ID`);
+  7 main-catalog tools (Slack ×2, GoogleDocs ×4, Brightdata ×1). See `config/targets.yaml`.
+  Confirmed live 2026-06-18: tool list is gateway-wide (same for all `Arcade-User-ID`s).
 - **Shared reference server:** _name + tools echo/whoami/add (Task 1.4)_
 - **`whoami` identity field:** _exact field the server reads (Task 1.4 / 2.4)_